turnip

Merge ~pelpsi/turnip/+git/dependencies:gunicorn-upgrade-HTTP-request-smuggling-vulnerability into ~canonical-launchpad-branches/turnip/+git/dependencies:master

  1. Git
  2. lp:~pelpsi/turnip/+git/dependencies
  3. gunicorn-upgrade-HTTP-request-smuggling-vulnerability
  4. Merge into master
Proposed by Simone Pelosi
Status: Merged
Approved by: Simone Pelosi
Approved revision: b57ddda3727bb7a92169c368c0f6ba283dc72cd6
Merge reported by: Otto Co-Pilot
Merged at revision: not available
Proposed branch: ~pelpsi/turnip/+git/dependencies:gunicorn-upgrade-HTTP-request-smuggling-vulnerability
Merge into: ~canonical-launchpad-branches/turnip/+git/dependencies:master
Diff against target: 4 lines (+0/-0)
0 files modified
Reviewer Review Type Date Requested Status
Guruprasad Approve
Review via email: mp+440163@code.launchpad.net

Commit message

Upgraded gunicorn to fix HTTP request smuggling vulnerability

A penetration test found that our gunicorn version is vulnerable, version 20.1.0 should be safe.

To post a comment you must log in.
Revision history for this message
Guruprasad (lgp171188) wrote :

LGTM 👍🏼 But, afaik, we have a process of not removing the existing version when adding a newer version and the older version removed later separately when the older version is not used anywhere.

review: Needs Fixing
Revision history for this message
Guruprasad (lgp171188) wrote :

LGTM 👍🏼 Simone, can you squash these commits into one before merge so that there is just the addition of the newer version and the older version is not at all touched?

review: Approve
Revision history for this message
Simone Pelosi (pelpsi) wrote :

> LGTM 👍🏼 Simone, can you squash these commits into one before merge so that
> there is just the addition of the newer version and the older version is not
> at all touched?
Sure!

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1diff --git a/gunicorn-20.1.0.tar.gz b/gunicorn-20.1.0.tar.gz
2new file mode 100644
3index 0000000..b5da493
4Binary files /dev/null and b/gunicorn-20.1.0.tar.gz differ

Subscribers

People subscribed via source and target branches